Transaction Security. salesforce Salesforce Organization

PDF

Documento

Anúncio

Set Up and Maintain Your Salesforce Organization Transaction Security

Note: Although non-admin users with the permission can view the Identity Verification Methods report, they can’t create custom reports that include data restricted to users with the “Manage Users” permission.

Transaction Security

Transaction Security is a framework that intercepts real-time Salesforce events and applies appropriate actions and notifications based on security policies you create. Transaction Security monitors events according to the policies that you set up. These policies are applied against events in your org and specify actions to take when certain event combinations occur. When a policy is triggered, you can have an action taken and receive an optional notification.

EDITIONS

Available in: both Salesforce

Classic and Lightning

Experience

IN THIS SECTION:

Transaction Security Policies

Policies evaluate activity using events you specify. For each policy, you define real-time actions, such as notify, block, force two-factor authentication, or choose a session to end.

Set Up Transaction Security

Activate and configure transaction security on your org before creating your own custom policies. Only an active user assigned the System Administrator profile can use this feature.

Available in: Enterprise,

Performance, Unlimited, and Developer Editions.

Requires purchasing

Salesforce Shield or

Salesforce Shield Event

Monitoring add-on subscriptions.

Create Custom Transaction Security Policies

Create your own custom policies, triggered by specific events. Only an active user assigned the System Administrator profile can use this feature.

Apex Policies for Transaction Security Notifications

Every Transaction Security policy must implement the Apex

TxnSecurity.PolicyCondition

interface. Here are several examples.

Manage Transaction Security Policies

Use Transaction Security policies to define, enable, and generate Apex code to implement your policies. Specify how to be notified when a policy is triggered, and then select the policies to enable. Only an active user assigned the System Administrator profile can use this feature.

Receiving Transaction Security Notifications

You receive the notifications you’ve selected when an enabled policy is triggered. The notifications are formatted for easy recognition.

589

Set Up and Maintain Your Salesforce Organization Transaction Security

Transaction Security Policies

Policies evaluate activity using events you specify. For each policy, you define real-time actions, such as notify, block, force two-factor authentication, or choose a session to end.

When you enable Transaction Security for your org, two policies are created:

•

Concurrent Sessions Limiting policy to limit concurrent login sessions

•

Lead Data Export policy to block excessive data downloads of Leads

EDITIONS

Available in: both Salesforce

Classic and Lightning

Experience

The policies’ corresponding Apex classes are also created in the org. An administrator can enable the policies immediately or edit their Apex classes to customize them.

For example, suppose that you activate the Concurrent Sessions Limiting policy to limit the number of concurrent sessions per user. In addition, you change the policy to notify you via email when the policy is triggered. You also update the policy’s Apex implementation to limit users to three sessions instead of the default five sessions. (That’s easier than it sounds.) Later, someone with three login sessions tries to create a fourth. The policy prevents that and requires ending one of the existing sessions before proceeding with the new session. At the same time, you are notified that the policy was triggered.

Available in: Enterprise,

Performance, Unlimited, and Developer Editions.

Requires purchasing

Salesforce Shield or

Salesforce Shield Event

Monitoring add-on subscriptions.

The Transaction Security architecture uses the Security Policy Engine to analyze events and determine the necessary actions.

A transaction security policy consists of events, notifications, and actions.

•

Policies to apply to the organization, made up of events. Available event types are:

–

Data Export for Account, Contact, Lead, and Opportunity objects

–

Entity for authentication providers and sessions, client browsers, and login IP

–

Logins

–

Resource Access for connected apps and reports and dashboards

•

Available policy notifications—You can be notified via email, by an in-app notification, or both.

•

Actions to take if the policy is triggered:

–

Block the operation

–

Require a higher level of assurance using two-factor authentication

590

Set Up and Maintain Your Salesforce Organization Transaction Security

–

End a current session

You can also take no action and only receive a notification. The actions available depend on the event type selected.

Set Up Transaction Security

Activate and configure transaction security on your org before creating your own custom policies.

Only an active user assigned the System Administrator profile can use this feature.

1. Enable transaction security policies to make them available for use.

a. From Setup, enter

Transaction Security

in the

Quick Find

box, then select

Transaction Security.

b. Select Enable custom transaction security policies at the top of the page.

The ConcurrentSessionsLimitingPolicy limits concurrent sessions and is triggered in two ways:

•

When a user with five current sessions tries to log in for a sixth session

When an administrator that’s already logged in tries to log in a second time

You can adjust the number of sessions allowed by changing the Apex policy implementation

ConcurrentSessionsPolicyCondition

The Lead Data Export policy blocks excessive data downloads of leads. It’s triggered when a download either:

•

Retrieves more than 2,000 lead records

•

Takes more than one second to complete

You can change these values by modifying the policy implementation.

DataLoaderLeadExportCondition

EDITIONS

Available in: both Salesforce

Classic and Lightning

Experience

Available in: Enterprise,

Performance, Unlimited, and Developer Editions.

Requires purchasing

Salesforce Shield or

Salesforce Shield Event

Monitoring add-on subscriptions.

USER PERMISSIONS

To create, edit, and manage transaction security policies:

•

“Author Apex”

AND

“Customize Application”

2. After Transaction Security is enabled, set the preferences for your org.

a. Click Default Preferences on the Transaction Security Policies page.

b. Select the preference When users exceed the maximum number of Salesforce sessions

allowed, close the oldest session.

Login policies affect programmatic access and access from Salesforce Classic and Lightning Experience. When you create a policy that limits the number of concurrent user sessions, all sessions count toward that limit. Regular logins with a username and password, logins by web applications, logins using Authentication Providers, and all other login types are considered.

The session limit isn’t a problem in Salesforce Classic or Lightning Experience because you’re prompted to select which session or sessions to end. That choice isn’t available from within a program, so the program receives a Transaction Security exception that the session limit has been reached.

To prevent this problem, select When users exceed the maximum number of Salesforce sessions allowed, close the oldest

session.. Then when a programmatic request is made that exceeds the number of sessions allowed, older sessions are ended until the session count is below the limit. The setting also works for logins from the UI. Instead of being asked to select a session to end, the oldest session is automatically ended, and the new login proceeds for the new session. Here’s how the OAuth flows handle login policies with and without the preference being set.

591

Set Up and Maintain Your Salesforce Organization Transaction Security

Flow Type

OAuth 2.0 web server

Action If Preference Is Selected Action If Preference Is Not Selected

Authorization Code and Access Token granted

Older sessions are ended until you’re within policy compliance.

Authorization Code granted, but Access Token not granted

Older sessions are ended until you’re within policy compliance.

OAuth 2.0 user-agent

OAuth 2.0 refresh token flow

Access Token granted

Older sessions are ended until you’re within policy compliance.

Access Token granted

Older sessions are ended until you’re within policy compliance.

Access Token granted

Older sessions are ended until you’re within policy compliance.

TXN_SECURITY_END_SESSION exception

OAuth 2.0 JWT bearer token Access Token granted

Older sessions are ended until you’re within policy compliance.

TXN_SECURITY_END_SESSION exception

OAuth 2.0 SAML bearer assertion

Access granted

Older sessions are ended until you’re within policy compliance.

TXN_SECURITY_END_SESSION exception

OAuth 2.0 username and password

Access granted

Older sessions are ended until you’re within policy compliance.

Access denied due to more than the number of sessions allowed by the policy

SAML assertion Not applicable Not applicable

For more information on authentication flows, see Authenticating Apps with OAuth in the Salesforce help.

592

Set Up and Maintain Your Salesforce Organization Transaction Security

Create Custom Transaction Security Policies

Create your own custom policies, triggered by specific events. Only an active user assigned the

System Administrator profile can use this feature.

1. From Setup, enter

Transaction Security

in the

Quick Find

box, select

Transaction Security, and then click New in Custom Transaction Security Policies.

2. Enter the basic information fields for your new policy.

•

For clarity and easier maintenance, use similar names for the API and the policy. This name can contain only underscores and alphanumeric characters, and must be unique in your org. It must begin with a letter, not include spaces, not end with an underscore, and not contain two consecutive underscores.

•

Event Type

—Determines the available actions. It can be one of the following:

–

Login—A user login. Login lets you set any combination of notifications, plus these actions:

•

Block access completely

•

Continue, but require two-factor authentication

•

Continue, but require the end of a current login session

EDITIONS

Available in: both Salesforce

Classic and Lightning

Experience

Available in: Enterprise,

Performance, Unlimited, and Developer Editions.

Requires purchasing

Salesforce Shield or

Salesforce Shield Event

Monitoring add-on subscriptions.

USER PERMISSIONS

–

Entity—An object type. Select a specific resource and the type of notifications desired.

–

Data Export—Notifies you if the selected object type has been exported. Available object types are Account, Case, Contact, Lead, and Opportunity. To trigger a policy, the export must be done using a default report type from the Report tab or with an API client like Data Loader or Workbench.

–

AccessResource—Notifies you when the selected resource has been accessed. You can block access or require two-factor authentication before access is allowed.

To create, edit, and manage transaction security policies:

•

“Author Apex”

AND

“Customize Application”

•

Notifications

—You can select all, some, or no notification methods for each policy.

•

Recipient

—Must be an active user assigned the System Administrator profile.

•

Real-time Actions

—Specifies what to do when the policy is triggered. The actions available vary depending on the event type. Email and In-App notifications are always available. For login and resource events, you can also block the action or require a higher level of access control with two-factor authentication. For Login events, you can require ending an existing session before continuing with the current session. You can set the default action for ending a session to always close the oldest session.

Note: Two-factor authentication is not available in Salesforce1 or Lightning Experience for the AccessResource event type. The Block action is used instead.

Important:

If you create a policy requiring the two-factor authentication action, provide your users a way to get a time-based, one-time password. This password is their second authentication factor. Otherwise, if your users encounter a situation that requires a second authentication factor, they can’t finish their task, such as logging in or running a report.

•

You can use an existing class for

Apex Policy

or select Generate Apex to have a default policy class created that implements the

TxnSecurity.PolicyCondition

interface. You can also write your own policy to take advantage of any customizations you’ve made to your org.

•

The user selected for

Execute Policy As

must have the System Administrator profile.

3. You can optionally create a condition for a specific property as part of the policy. For example, you can create a policy that’s triggered when a report or dashboard is accessed from a specific source IP. The source IP is the property you’re checking.

593

Set Up and Maintain Your Salesforce Organization Transaction Security

•

The available properties depend on the event type selected.

•

For example, with Login events, property changes that occurred within a given number of days or an exact match to a property value are available.

4. To enable a policy, select the policy’s checkbox. You can enable and disable policies according to your requirements.

5. Click Save.

After saving your selection, you’re shown the editing page for your new policy. You can modify your policy here and review its Apex class.

If you didn’t specify a condition value before you generated the Apex interface for a policy, you can add the condition later. If you want to change the condition, you can edit it. Edit the Apex code to include a condition before you activate your policy. If you never include

a condition, your policy is never triggered. See Apex Policies for Transaction Security Notifications

for examples.

You can create multiple policies for the same type of event, but we recommend that your policies and their actions don’t overlap. All the policies for a given event execute when the event occurs, but their order of execution is indeterminate. For example, if you have two policies enabled for an exported contact, you can’t be sure which policy is triggered first. If one policy copies the contact and the other policy deletes the contact, the copy operation fails if the deletion is done first.

Apex Policies for Transaction Security Notifications

Every Transaction Security policy must implement the Apex

TxnSecurity.PolicyCondition

interface. Here are several examples.

Don’t include Data Manipulation Language (DML) statements in your custom policies. DML operations are rolled back after a transaction security policy is evaluated, regardless if the policy evaluates to true

or false

When you delete a transaction security policy, your

TxnSecurity.PolicyCondition

implementation isn’t deleted. You can reuse your Apex code in other policies.

This Apex policy example implements a policy that is triggered when someone logs in from multiple

IP addresses in the past 24 hours.

Example: global class LoginPolicyCondition implements

TxnSecurity.PolicyCondition { public boolean evaluate(TxnSecurity.Event e) {

AggregateResult[] results = [SELECT SourceIp

FROM LoginHistory

WHERE UserId = :e.userId

AND LoginTime =

LAST_N_DAYS:1

GROUP BY SourceIp]; if(!results.isEmpty() && results.size() > 1) { return true;

} return false;

}

EDITIONS

Available in: both Salesforce

Classic and Lightning

Experience

Available in: Enterprise,

Performance, Unlimited, and Developer Editions.

Requires purchasing

Salesforce Shield or

Salesforce Shield Event

Monitoring add-on subscriptions.

594

Set Up and Maintain Your Salesforce Organization Transaction Security

This Apex policy example implements a policy that is triggered when a session is created from a specific IP address.

Example: global class SessionPolicyCondition implements TxnSecurity.PolicyCondition { public boolean evaluate(TxnSecurity.Event e) {

AuthSession eObj = [SELECT SourceIp FROM AuthSession WHERE Id = :e.entityId]; if(eObj.SourceIp == '1.1.1.1' ){ return true;

} return false;

}

This DataExport policy implements a policy that is triggered when someone exports data via the Data Loader.

Example: global class DataExportPolicyCondition implements TxnSecurity.PolicyCondition { public boolean evaluate(TxnSecurity.Event e) { if(e.data.get('SourceIp') == '1.1.1.1' ){ return true;

} return false;

}

This Apex policy is triggered when someone accesses reports.

Example: global class ReportsPolicyCondition implements TxnSecurity.PolicyCondition { public boolean evaluate(TxnSecurity.Event e) { if(e.data.get('SessionLevel') == 'STANDARD' ){ return true;

} return false;

}

This Apex policy is triggered when someone accesses a Connected App.

Example: global class ConnectedAppsPolicyCondition implements TxnSecurity.PolicyCondition { public boolean evaluate(TxnSecurity.Event e) { if(e.data.get('SessionLevel') == 'STANDARD' && (e.entityId == '0CiD00000004Cce')){ return true;

} return false;

595

Set Up and Maintain Your Salesforce Organization Transaction Security

}

Manage Transaction Security Policies

Use Transaction Security policies to define, enable, and generate Apex code to implement your policies. Specify how to be notified when a policy is triggered, and then select the policies to enable.

Only an active user assigned the System Administrator profile can use this feature.

1. From Setup, enter

Transaction Security

in the

Quick Find

box, then select

Transaction Security.

2. From the Transaction Security Policies page, you can

•

Edit a view

•

Create a view

•

Edit a policy

•

Create a policy

•

Edit the

TxnSecurity.PolicyCondition

Apex class for a policy

•

Delete a policy

•

Set the transaction security default preferences

You can change the transaction security default preferences at any time.

EDITIONS

Available in: both Salesforce

Classic and Lightning

Experience

Available in: Enterprise,

Performance, Unlimited, and Developer Editions.

Requires purchasing

Salesforce Shield or

Salesforce Shield Event

Monitoring add-on subscriptions.

USER PERMISSIONS

To create, edit, and manage transaction security policies:

•

“Author Apex”

AND

“Customize Application”

596

Set Up and Maintain Your Salesforce Organization Transaction Security

Receiving Transaction Security Notifications

You receive the notifications you’ve selected when an enabled policy is triggered. The notifications are formatted for easy recognition.

Email Notifications

Email notifications are sent from Transaction Security with subject “Transaction Security Alert!” The body of the message contains the policy that was triggered and the event or events that occurred to trigger the policy. The times listed are when the policy was triggered in the recipient’s locale and time zone. For example, a policy is triggered at 6:46 PM in the Eastern Standard Time zone. The administrator receiving the notification is in the Pacific Standard Time zone, so the times are shown as PST. Here’s an example.

Example:

From: Transaction Security <[email protected]>

To: [email protected]

Sent: Friday, November 12, 2014, 5:35 PM

Subject: Transaction Security Alert!

This is a transaction security policy alert.

Policy: An administrator created a new user.

Event(s) responsible for triggering this policy:

1. Created new user Lisa Johnson at 11/12/2014 5:35:09 PM PST

EDITIONS

Available in: both Salesforce

Classic and Lightning